American Megatrends, Inc.

Aptio4 Secure Boot Package v.25

Copyright

Release Notes

© American Megatrends, Inc.


General Information

APTIO Secure Boot integration & testing guide

Porting Information : AMI_Aptio_4.6.x_Secure_Boot_Integration_Guide_NDA.doc

Secure Boot Setup page layout : Secure Boot Setup Page Layout

Making of UEFI Signing Components : AMI_Aptio_Guide_to_UEFI_Signing_components_NDA.doc


Release Notes - NDA Required

Information:

Component Name: Aptio Secure Boot Package

Component Type: DXE BS, DXE RT driver

AMI BIOS Core: Aptio 4.6.5.1

Location on SourceSafe: $/Alaska/SOURCE/Modules/SecureBoot_WIN8/;

Label: 4.6.5.1_SECUREBOOT_WIN8_025

Date: 2015-06-22

Component Description:

The module enables Aptio4 based project to comply with Secure Boot requirements defined in UEFI 2.3.1c(+2.4 errata) and MS Windows 8.1 BIOS requirements.

Secure Boot package is assembled from the following modules:

-NVRAM Authenticated Variable Library

-Image Authentication Library

-Default Ami Secure Boot Variables

Note1: Dependent on following generic Aptio eModules: Crypto Package

Note2: Default Secure Variables PK, KEK, db, dbt and dbx should be updated and signed by OEM PK/KEK Keys.

Follow directions in the attached AMI_Aptio_Guide_to_UEFI_Signing_components_NDA.doc document to create unique PK and KEK Key certificates.

AMI Build Tools:

Tools Label: 4.5.5_TOOLS_35, Dated: 2011-03-29

Visual eBios: RSS.5.70, Dated: 2010-10-06

Modules update from last label:

* Required Fixes are in Red

Modules added to this label:

Modules removed from last label:

New features added in this label:

SecureBoot.sdl:

Set SECURE_BOOT_MODULE_REVISION = 25

Variables\dbx

Updated “dbx” file with a MS released copy and available here: http://www.uefi.org/revocationlistfile. The file is signed with Microsoft KEK (encoded as specified by the UEFI spec) and

includes hashes of 13 revoked certificates. Windows 10 Secure Boot logo test now requires this dbx to be present for “out-of-box” experience

SecureBoot.c:

Update Default Key Provision logic: 1) handle “no default keys” scenario; 2) skip system reset after provisioning if Boot Mode is “Flash Update” or “Recovery”.

DxeImageVerificationLib.c

Modify certificate offset calculation inside DxeImageVerificationHandler() to match EDKII version:

Old : OffSet += WinCertificate->dwLength, OffSet += ALIGN_SIZE (OffSet)

New: OffSet += (WinCertificate->dwLength + ALIGN_SIZE (WinCertificate->dwLength))

General Bug Fixes:

DxeImageVerificationLib.c

EIP#219415: [Root cause] Image from PXE server gets cloned device’s path from its parent network controller with PciIo protocol and embedded PCI ROM attributes.

[Solution] Add checking for unique nodes in the file path for the embedded Pci OpROMs.

EIP addressed in this label:

EIP#219415: UEFI PXE can launch unsigned images when SecureBoot is enabled.

Files changed for EIP fixes:

dbx; DxeImageVerificationLib.c ; SecureBoot.c

Known issues and limitations in this label:

Requires CryptoPkg 4.6.5.x_CRYPTOAPI_017 or latest

Use ENABLE_IMAGE_EXEC_POLICY_OVERRIDE token to include “Image Execution policy” Setup page.

WARNING!!! Presence of “Image Execution Policy” Setup page is controlled by ENABLE_IMAGE_EXEC_POLICY_OVERRIDE token. Policy override Setup page provides functionality that may violate Secure Boot requirements for the UEFI firmware to not have an in-line mechanism to bypass secure boot failures. Therefore the Image Execution policy should only be used during Platform development phase and must be removed in Released products. Available policy options are limited by values from corresponding SDL tokens in ImageVerificationLib.sdl

Unit Testing:

DOCUMENT ANY UNIT TESTING DONE BY ENGINEERING

Validation Testing:

EIP#224418: Validation completed for label 4.6.5.1_SECUREBOOT_WIN8_025. Test results are attached to the EIP

3rd Party Code Present in Component:

none

Release History:

4.6.5.1_SECUREBOOT_WIN8_024

EIP#163153: update 4.6.5.5_TCG_43 is build error. Bug: Global variable name NvramControl shared with TpmClearOnRollbackOfbd.

EIP#200639: When the token DEFAULT_PROVISION_SECURE_VARS enable, the secure boot status is Not Active when first enter setup.

EIP#201422: set SecVariables_SUPPORT = 0, code will build fail.

EIP#192504: Prevent Built In EFI Shell boot option from being created in BDS when Secure Boot is enabled

EIP#197749: Need to authenticate images loaded from external FV

Auth2Variable.c: Compliancy with UEFI spec: EFI_VARIABLE_AUTHENTICATION_2.TimeStamp - during Append operations the TimeStamp value may be set to '0'

SecureBootMod.c: Implement User prompt to install Secure Boot key defaults while switching of Secure Boot mode from Custom to Standard (per Windows8+ Hardware Certification requirements).

4.6.5.1_SECUREBOOT_WIN8_023

SecureBootMod.c;.sd:

EIP#137818: SecureBootSetup variables are not preserved after flash update even though PRESERVE_SECURE_VARIABLES enabled. The fix to temporary toggle internal SMM NVRAM flag to gain access to non-RT variables

EIP#144146: "Secure boot menu" will be hidden when access level is user. Unhide the Secure Boot menu. Don't hide Secure Boot menu if in User mode. Instead - keep all controls greyed out

EIP#135353: file contains one dummy SHA256 Hash certificate with a hash of value “0”. Update dbx file to include single dummy SHA256 Hash certificate with a hash of value “0”

4.6.5.1_SECUREBOOT_WIN8_022

EIP#131032: SECURITY: Concerns about Firmware Update Procedures. Enable PRESERVE_SECURE_VARIABLES switch by default

EIP#118850: Implement support for UEFI2.4 ECR 1009: Certificate Revocation Storage reduction and Timestamp Support

Add feature not to erase existing Sec Boot variables from NVRAM if no defaults of same exist in the FV

4.6.5.1_SECUREBOOT_WIN8_020

EIP#127292 Item#1. Remove RT attribute from SecureBootSetupVar

EIP#122339: Secure Boot Vulnerabilities

EIP#125931: Security review: HashPeImage does not validate certificate table offset and size

EIP#124444: Secure boot improvement for LoadImage call with NULL DevicePath

Inclusion of Image Execution Setup page controlled by ENABLE_IMAGE_EXEC_POLICY_OVERRIDE token.

4.6.5.1_SECUREBOOT_WIN8_019

Add Secure Boot Setup Page Layout to General Information page

AuthVariable.c Related change EIP#122063: SecureBoot variable is set once during AuthVar Init() and cannot change in runtime

Auth2Variable.c(h)Optimized the code flow for Time-Based Variables. Removed unused arguments from ProcessVarWithPk & ProcessVarWithKek

SecureBootMod.sdl(.c;.sd,.uni): Security->Secure Boot Setup Page: Security->Secure Boot->Key Management page

DxeImageVerificartionLib.c (.h) Removed “append” image certificates to db from User Query dialog. There are multiple scenarios (e.g. multi-signing certificates) when it’s impossible to preserve a pointer to a certificate. This

feature can be restored if demand is high.

EIP#118850: ECR1009: Add placeholder defines for "dbt"

EIP#122339: GetImageType() detect if PciOpROM image is loaded from internal FV by checking the corresponding PCI I/O instance for the embedded attribute.

EIP#117187: Replaced expired on 02/13/2013 PK and KEK test certificate files with new ones expiring in 4 years from now.

EIP#115120: Secureboot Firmware does not verify duplication before Appending to the variable

EIP#114350: Need sdl Token for SecureBootMode default value

EIP#114998: AMIUEFI - BitLocker TPM failed to bind to PCR7. Wrong certificate size passed in PCR[7] calculation

EIP#118243: Add support for multi-signed PE Images

4.6.5.1_SECUREBOOT_WIN8_018

EIP#108982: "Secure Boot" Multilanguage Support missing

EIP#104046: Fixed security issues per #2,3,4,5,6,7 of security review findings

SecureBootMod.c(.uni): Move all locally defined strings under .uni. Retrieve strings using updated GetHiiString() function.

Auth(2)Variable.c, SecureBootMod.sd(.c): Code fixes according to "cppcheck" style & performance suggestions

4.6.5.1_SECUREBOOT_WIN8_017

Auth(2)Variable.c: 1. EIP#98995, EIP#102807 : WHCK tests fail.

-removed mAuthVarLock logic, use PhysicalUserPresent() hook to unlock Secure Variables for write/erase

-Verify(2)Variable() Fix final check for IsPk and run ValidateSignatureList()

2. ValidateSelfSigned(): keep *x509_SignCert ptr to non-0 for Pkcs7CertValidateGetSignerKeyHash operation. May trigger an error in CryptoDxe.c Pkcs7Verify()

SecureBootMod.sd(.c): RestoreSecureVariables(): removed unreferenced “UINTN VarSize”. May cause build errors depending on compiler warning level

4.6.5.1_SECUREBOOT_WIN8_016

SecureBootMod.c EIP:105537 BIOS setup "Secure Boot Control" cannot change to disable; Fix interactive menus for Set/Append Key operations; Fix: ValidateSignatureList () returned Success even if no sig detected if file size = 0

Fix dependency on SetupMode for SecureBoot Enable switch inside SetMode callback; Replaced wrong return types for Hii Callback routines from EFI_SUCCESS to EFI_STATUS; Removed Authenticated attribute from generic R/O

UEFI Variables PKDefault, etc.

AuthVariable(2).c: EIP:104961 UEFI 2.3.1 SCTc test failed in Generic\EfiCompliant case. Fix for SelfSigned variables

DxeImageVerification.c: EIP:104046 Includes the fix for items: #4: HashPeImage returns TRUE even in error case; #7 from the list attached to the EIP; IsPkcsSignedDataVerifiedBySignatureList() Fix CertData size - exclude EFI_GUID

Size

AuthVariable.c(.sdl.mak.h): Implemented R/O Variables support via fixed and OEM defined (eLink) lists. R/O logic includes Name and Vendor GUID check.

SecureBootMod.sd(.c,*.sdl): Merge Set and Append Hii callbacks with common routine SetAppendDb.

Fix for Win8 SecureBoot logo requirement: restore Secure Boot state across flash updates. Move all secure boot Setup settings to a separate varstore variable (SecureBootSetup) in order to preserve settings across re-flash

(INT)4.6.5.1_SECUREBOOT_WIN8_0161

AuthVariable.c:

Include facility to link external Physical User Presence detection hooks via eLink: PhysicalUserPresenceDetect. Dummy hook AuthVarAdminUserPresent() is provided that will unlock secure variables when Admin User is logged in.

Optimized mAuthVarLock logic. Set Secure Variables remain “unlocked” till BdsConnect event, then will be checking physical user presence hook.

SecureBootMod.sd(.c,*.sdl):

Prevent user to enable Secure boot via “Secure Boot control” setup option if platform is running in Setup Mode (no PK key) or the CSM is loaded.

Function is suppressed if DEFAULT_SECURE_BOOT_ENABLE is set to 1(Enable).

Update all Secure Boot callback functions to return EFI_STATUS. Matches the format of the callback consumer call in Setup.c module.

DxeImageVerification.c:

Fix bug in HashPeiImage. The last step #16 (Hashing of optional data structures after the Certificate entry) was not functional

Fix code branch for PE images signed with WIN_CERT_TYPE_EFI_GUID certificates (not used in Authenticode signing)

Fix code branch to return action status EFI_IMAGE_EXECUTION_AUTH_UNTESTED. It was overwritten by EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED

4.6.5.1_SECUREBOOT_WIN8_015

SecureBootMod.sd(.c,*.sdl):

1. Remove dependency on newer Cores 4.6.5.0+: CORE_COMBINED_VERSION >= 0x4028a. Win8 compliant BIOS must have upgraded Core components, TSE

2. In order to keep Secure Boot setup switch interactive, add dependency for SECURE_BOOT_SUPPORT_CHANGE_KEY event on revision of CsmOptOut eModule (rev>=4).

DxeImageVerification.c:

1. IsPkcsSignedDataVerifiedBySignatureList(). Fixed a bug causing the function always return Success skipping the Image Verification code branch.

2. Run Image Verification in simulation mode when platform is in SetupMode(SecureBoot is Off) and SecureBoot Mode selector is set to “Custom”.

This mode allows to exercise different Image execution policies and to allow physically present user to enroll Image Certificates to Signature Database (db) while in Setup Mode

4.6.5.1_SECUREBOOT_WIN8_014

EIP#99676: SecureBootMod.sd: The implementation had a couple of issues with TSE's form discard with Aptio Core 4.6.5.3+

WARNING: On older Aptio Core versions (< 4.6.5.0) VfrCompiler may generate errors in SecureBootMod.sd due to incompatible syntax of ‘questionid’ and

‘INTERRACTIVE’ constructions. User may need to upgrade Aptio Core support for EFI_SPECIFICATION version to 2.1 (SDL:0x2000A) or edit this SecureBootMod.sd to

remove unsupported keywords e.g. remove ‘INTERACTIVE’ in ‘one of’ structures and add ‘, key=0’ instead. Also remove ‘questioned’ from ‘oneof’ constructions .

Note that above mentioned fixes will disable some of the Secure Boot page functionality

DxeImageVerification.c:

Add definition for EFI_MAX_ADDRESS if it's not defined elsewhere in included header files

Change search criteria for Device Path to match EDKII example: check FV path first and then Block I/O

EIP#99648: Auth2Variable.c: SCT will fail when enable Secure Boot in setup menu.

Fix: Use globally defined buffer to pass calculated Key Hash for Self-Signed Variables

4.6.5.1_SECUREBOOT_WIN8_013

SecureBootMod.c;*.sd;*uni;*sdl,*.mak

1. New SECURE_BOOT_MODULE_REVISION, helps to identify interfaces to other dependent modules.

2. New DEFAULT_SECURE_BOOT_ENABLE, chooses default setting for Secure Boot Setup switch. Secure Boot Control setup value made dependent on Platform Mode.

When default setting of this Token is 0 (Disabled) – the platform must be in User Mode with PK key installed in order for ‘Enable’ setup option to become available.

Goal – restrict user to Enable Secure Boot support if Platform Key not provisioned.

3. Refresh Secure Boot Setup screens upon user load Defaults/Previous values

Link KEY_PROVISION_CHANGE_KEY event with common ForceSetupModeCallback()

4. Added first draft of the code with support for UEFI ECR874: Install Factory defaults as Read-only volatile variables for key distribution.

5. Update Secure Boot page layout.

5.1. Hide all controls under new sub-page. Formatted strings to fit TSE Help panel

5.2. Key Management Page

5.2.1 Append Key controls include user selection for different file formats: Key Certificates in x509, RSA2048 & SHA256 or files formatted as Efi Signature Lists

5.2.2 Use single Save to files option for all Sec Variables

5.2.3 Set Variable Option gets a Key from File Browser menu or from Factory Defaults.

AuthVariable2.c

ProcessVarWithPk2(): Properly implemented the case for PK variable carrying RSA2048 Key Certificate. Requires CryptoPkg Label 009 or later.

AuthVariable.c(h)

Enhanced ValidateSignatureList() checking. SigList.Size field must have valid size.

UEFI ECR change. Don't install SignatureSupport Variable. It's obsolete from UEFI 2.3.1 Errata C

GetmSecureBootSupport(UINT8 SetupMode): Add input parameter SetupMode to control state of Setup Flag:SecureBootSupport

DxeImageVerificationLib.c

Update ImageVerification logic to the latest EDK2 patch (13469)

Add support for multiple Signatures within PE/COFF table

Additional PE Header validation checks

Variables

Add .Help file containing description of Key certificates included in each Secure Variables

Modify Build rules in order to let file overrides from Create Secure Variables eModule

4.6.5.1_SECUREBOOT_WIN8_012

EIP#91587: Function HiiLibSetBrowserData always return error under new tse.

FIX in UpdateSecureVariableBrowserInfo() -> call HiiLibSetBrowserData() only when called from HiiCallback

EIP#89280: When secure boot enable with secure flash disable, in Security page of setup menu same items will exist twice

FIX: modify rules to suppress lines for installed Variables

EIP#90468: UEFI Secure Boot implementation inquiry.

FIX: Key Management Setup page->”Get File”. File is formatted with dummy AuthHdr on top of exportable Variable data in order to make the file importable by Key Management page

Any EFI OS testing of a Secure Boot must be done on a Released version of the BIOS. Debug version may hang on some older Cores versions due to runtime traces may not be handled

Properly. Must use latest NVRAMDXE.C (VSS version 92 or later)

EIP#82122: "Secure Boot Manual Logo Test" fails. Append after Garbage collection had a bug.

EIP#88439: WHCK 8319 Secure Boot logo Manual test (clearSecureBootConfiguration). After ExitBootServices(), attempting to call GetVariable() on an existing variable with attributes

"NV,BS" should fail.

4.6.5.1_SECUREBOOT_WIN8_011

EIP#82334: TSE Text Verification test failed on Secure Boot-> Key Management page.

EIP#88439: Test with WHCK 8319 Secure Boot logo Manual test: The error message display after ran "clearSecureBootConfiguration.ps1

EIP#80874: Made changes to support PCR[7] measurements for Secure Boot state in TCG

EIP#86988: Secure Boot feature: Update VerifyCertPkcsSignedData() to support extended search in Forbidden db for any leaf certificate, not only the Root CA

EIP#88261: Default Secure Variables are being reinstalled on each system reboot when "DEFAULT_PROVISION_SECURE_VARS" is enabled

EIP#86543: Fix to support verification of uefi oprom from pci card

4.6.5.1_SECUREBOOT_WIN8_010

SecureBootMod.c (*.sdl, *.sd) AppendSecureBootDBCallback. Fixed Append Callback function. Removed DEL attribute when do Append;Add check if "DEFAULT_PROVISION_SECURE_VARS"

is defined. Fix build error for condition SET_SECURE_VARS = 0; SecureBootMod_Init: Update browser info after DefaultKeys are provisioned.; Disable "Key Delete" controls if

DEFAULT_PROVISION_SECURE_VARS is set

AuthVariable.sdl, *.c -EIP#82122. WHCK "Secure Boot Manual Logo Test" fails. Fixed Append logic to process multiple sig data instances in a single Signature List block; New logic will

remove duplicated certs and update new SigList header.; -Add build time switch USER_MODE_POLICY_OVERRIDE; AuthVariable logic will allow override/erase Secure Variables without

enforcing Authentication rules until receiving EFI ReadyToBoot event.

DxeImageVerificationLib.c 1. Bug fix: EIP:78978:Secure boot will hang at CP 0x72; ConOut & ConIn are not available until later in BDS phase, earlier calls to display User Prompt may

hang the System; 2. Bug fix:EIP:77088 SecureBoot: Image can be loaded if click "No" when query user after image verification failed. ; ImageAuthorization() -> Return

EFI_ACCESS_DENIED on User Override option; GetImageType() - Fix for Image Device Path resolution. Added SubType = MEDIA_FV_FILEPATH_DP to search options for

MEDIA_DEVICE_PATH. ; It appears SmmDriverDispatcher sets this device path for files loaded by SmmDispatcher.; GetImageType(). Fixed possible security risk: Block I/O Device Path

check made higher priority then of FV device path.

db(x) EIP:77457: of set secure variable "dbx" failed in Setup menu or Shell; Checking in versions of db and dbx signed with valid PK-"AMI Test PK". This will enable users to test the

default

variables in User (signature check) mode ; Appended new certificate from Msft: Microsoft Windows Production PCA 2011.This is a WHCK Requirement update for Secure Boot.

4.6.5_SECUREBOOT_WIN8_009

Secure Variables Validate “db” with PK if none of KEKs are matching.

The fix is made in accordance to UEFI 2.3.1 Sec 7.2.1: "db" vars can be validated either by KEK key or by PK key

SecureBootMod.c ForceSetupModeCallback: initialize Status variable with default value as not all execution path update this variable

Secure Variables Removed “test” Microsoft certificates from KEK and db Signature Databases in order to meet WLK 1.0.7 test requirements (INT)4.6.5_SECUREBOOT_WIN8_008

NVRAM. Auth Variables. AuthVariable.c. Made temporary code fixes to make SCT 2.3.1 TW (10-26-11) to pass.

SecureBootMod.c(sdl, .sd, .uni) Change the appearance of Secure Boot items on Setup Security page. Added Key provisioning controls.

Secure Variables. Update KEK and db Signature Databases with new UEFI CA certificates

4.6.5_SECUREBOOT_WIN8_007

Added Secure Variables. Contain dummy PK,KEK db & dbx variables to be set as default Platform Keys during platform provisioning

© American Megatrends Inc.


Release Notes - NDA Required

Aptio Secure Boot Setup menu

Aptio “Security” Setup Page provides flexibility for power users to modify Secure Boot policies and manage Secure Boot Key database.

Following section describes Secure Boot related Setup options in detail:

Secure Boot information:

System Mode : Setup/User (Reflect current UEFI System Mode)

Secure Boot : Active/Not Active (Reflecting current Secure Boot status the Platform is in)

Secure Boot Interactive controls:

Secure Boot support : Enabled/Disabled (Secure Boot support switch. Enable Secure Boot if System is in User mode.)

Secure Boot mode : Standard/Custom (Secure Boot mode selector. 'Custom' Mode allows physically present users ability to modify Image Execution policy and Secure Boot Keys)

Secure Boot sub-menus

Key Management page

Provides user with options to modify Secure Boot variables: PK, KEK, db(t) and dbx.

Full Secure Boot key database update:

Factory Default Key Provisioning (Install Factory default Secure Boot Keys when System is in Setup Mode)

Enroll All Secure Boot Variables (Force System to User Mode - install all Factory Default keys (PK,KEK,db,dbx))

Delete All Secure Boot Variables (Force System to Setup Mode - clear all Secure Boot Variables (PK,KEK,db,dbx))

Save All Secure Boot Variables (Store content of each Secure Boot Variable(data formatted as EFI_SIGNATURE_LIST) to a file with matching name on selected file system's root folder)

Individual Key Variable management:

Delete Key (Delete the Variable from NVRAM. Note: Removing PK will reset System to Setup Mode)

Set New Key (Set new Key from a Factory defaults or from a file)*

Append Key (Appends Key(s) to existing Variable)*

*Note: Common Options for Set.. and Append…controls:

Update ‘Key’ from Factory Defaults (Restores the factory default ‘Key’ variable)

Update ‘Key’ from a file

1. File Format: UEFI Time-Based Authenticated Variable

2. File Format: Certificate data formatted as

a. EFI_SIGNATURE_LIST data structure

b. Public key Certificate in EFI_CERT_X509(ASN1.1 DER encoded), EFI_CERT_RSA2048_GUID(256byte n-modulus or RSA Key)

c. EFI_CERT_SHA256_GUID (32byte SHA256 Hash)

Image Execution Policy page

Provides user dined options to manage efi image execution if image verification failed. Policy override is selectable per image device path.

WARNING!!! Policy override Setup page provides functionality that may violate Secure Boot requirements for the UEFI firmware not to have an in-line mechanism to bypass secure boot failures.

Therefore the Image Execution policy page should only be used during Platform development phase and must be removed in Released products.

Supported Device path selection:

  • Internal FV Always Execute
  • External EFI Option ROM Always Execute, Always Deny, Allow Execute, Defer Execute, Deny Execute, Query user
  • Removable Media Always Execute, Always Deny, Allow Execute, Defer Execute, Deny Execute, Query user
  • Fixed Media Always Execute, Always Deny, Allow Execute, Defer Execute, Deny Execute, Query user

Policy

Description

Details

Always Execute

Execute EFI image from specified device path without authentication.

May be needed to launch unsigned applications from a trusted device path.

Always Deny

EFI image will not be executed.

Block any Efi applications to run from a particular device path. E.g. don't launch Boot Loaders from a removable Media. Boot only from Fixed HDD.

Following Options will perform Image Verification and register results in Image Execution Table according to Section 27.7.3.2 Firmware Policy of UEFI 2.3.1. spec.

Allow Execute

Execute EFI image even if authentication failed.

Regardless of signature verification results the image will be executed. OS or OEM may include Efi management tools to inspect Image Execution Table for failed to verify images.

Implementation:

ImageVerification() will conduct verification but returns EFI_SUCCESS regardless of the outcome. In case of an error in validation, Image is registered in Image Execution Table (UEFI 2.3.1 Chapter 27.6.2 Image Execution Information Table).

Defer Execute

Execute EFI image if authentication passes, otherwise the EFI image won’t be executed immediately.

Similar to option "Allow Execute", only image is not immediately executed. Error is reported to LoadImage() caller which should stop further attempt to StartImage(). Some management tools should be able to launch a deferred image according to internal policy.

Example: Existing instances of UEFI Shell app will launch Efi Images even if LoadImage() returns "EFI_SECURITY_VIOLATION". The case in "Defer Execute" model.

If the Image is failed Authentication (due to multiple reasons: missing signature, invalid signature, no Key match in Good Signature Database, etc.), then the information about the image is recorded in Image Execution Table (see (UEFI 2.3.1 Chapter 27.6.2 Image Execution Information Table) and EFI_SECURITY_VIOLATION is returned to LoadImage. Upon receiving "EFI_SECURITY_VIOLATION" status LoadImage() logic will continue loading the Image and creating the ImageHandle. Therefore the Image should not be started but in case of EfiShell, failed status does not preclude it to execute StartImage() with valid ImageHandle.

Deny Execute

Execute EFI image if authentication passes otherwise the EFI image won’t be executed.

Standard Secure Boot policy setting. This is the only option that should be allowed during Secure Boot mode session

In cases when ImageVerification() call returns "EFI_ACCESS_DENIED",

LoadImage will break and return Error without creating an ImageHandle.

Query User

If image authentication failed, ask user to determine further action, allow or deny the image execution.

Physically present user makes a final decision whether to execute failed to authenticate image. Perhaps this option can be useful during testing of external PCI cards with unsigned Option ROMs when Secure Boot is turned on.

© American Megatrends Inc.


Function by File Name

AMIBIOS Function Reference

By File Name

The following is a list of the source files.
For a list in alphabetical order, see In Alphabetical Order.

Built on 18:52:14 06/22/15


Functions in Alphabetical Order

AMIBIOS Function Reference

In Alphabetical Order

The following topics provide a list in alphabetical order.
For a list by file name, see By File Name.

Built on 18:52:14 06/22/15


Copyright

American Megatrends, Inc.
5555 Oakbrook Parkway
Suite 200
Norcross, GA 30093 (USA)

Copyright (c) 1999-2015 American Megatrends, Inc. All Rights Reserved.

This publication contains proprietary information, which is protected by copyright. No part of this publication may be reproduced, transcribed, stored in a retrieval system, translated into any language or computer language, or transmitted in any form whatsoever without the prior written consent of the publisher, American Megatrends, Inc.

American Megatrends, Inc. retains the right to update, change, modify this publication at any time, without notice.

For Additional Information

Call American Megatrends BIOS Sales Department at 1-800-828-9264 for additional information.

Limitations of Liability

In no event shall American Megatrends be held liable for any loss, expenses, or damages of any kind whatsoever, whether direct, indirect, incidental, or consequential, arising from the design or use of this product or the support materials provided with the product.

Limited Warranty

No warranties are made, either expressed or implied, with regard to the contents of this work, its merchantability, or fitness for a particular use. American Megatrends assumes no responsibility for errors and omissions or for the uses made of the material contained herein or reader decisions based on such use.

Trademark and Copyright Acknowledgments

All product names used in this publication are for identification purposes only and are trademarks of their respective Companies.